What Access Failed
npm was authenticated, but the registry returned 403 Forbidden because your account lacks permission for that package, scope, or action.
This is usually a target-and-identity problem, not a syntax problem. The request made it to the server, but the server did not like the credentials, permissions, or repository path attached to it.
Fix credentials and target access
Check the target and the credential together. Most of these fixes come down to using the right URL, account or token, and scope or repository permissions in the environment that actually failed.
Check which registry npm is using:npm config get registry
If the package is scoped, verify scope registry mapping in .npmrc (example: @your-scope:registry=...).
Confirm the registry identity:npm whoami (it should print a username for that registry).
If you are installing a private package, confirm your account has access (org membership / package access rules).
If you are publishing, confirm you are a maintainer:npm owner ls <pkg> and verify you have publish permission.
If you use GitHub Packages or another private registry, confirm the token has the correct scopes/permissions for that registry.
Retry with logs:npm --verbose (it shows which host returned 401/403).
Manual authentication checks
Print effective config with npm config list -l (look for registry and auth entries), and check .npmrc precedence (project, user, global) to ensure you are editing the right file.
Why It Happens
Usually this comes down to your .npmrc token is missing, expired, or scoped to the wrong registry host, you are installing a private package but you are not authenticated for that scope/registry, or the token is valid but lacks permission (forbidden) for the requested package or operation.
Prove the Failing Environment Can Reach It
Run npm whoami and confirm it succeeds, and re-run the original command and confirm the registry no longer returns 401/403.
How npm uses registry credentials
npm sends requests to the configured registry using credentials from .npmrc. Registry hosts treat tokens differently (npmjs vs GitHub Packages vs private registries). A mismatched registry host/token pairing is a common cause of 401/403.
Examples
npm ERR! code E403
npm ERR! 403 Forbidden: lite-server@latestKeep Credentials and Targets Aligned
To prevent this, use dedicated tokens for CI and rotate them periodically, keep .npmrc registry routing explicit for scoped packages, and use a proxy/cache registry to reduce auth surprises between environments.
Docs and source code
github.com/npm/cli/blob/417daa72b09c5129e7390cd12743ef31bf3ddb83/lib/utils/get-identity.js
This is a registry authentication call path. Auth errors like this code appear when the registry returns 401/403 for these endpoints. - GitHub
// No username, but we have other credentials; fetch the username from registry
if (creds.token || creds.certfile && creds.keyfile) {
const registryData = await npmFetch.json('/-/whoami', { ...opts })
if (typeof registryData?.username === 'string') {
return registryData.username
}